---
title: Configuring SCIM inbound provisioning
description: In the IdP Connections window, configure System for Cross-domain Identity Management (SCIM) inbound provisioning to provide a two-way mapping of attributes.
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:help_idpconnectionconfigtasklet_inboundprovisioningstate
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/help_idpconnectionconfigtasklet_inboundprovisioningstate.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 4, 2022
section_ids:
  about-this-task: About this task
  steps: Steps
  choose-from: Choose from:
---

# Configuring SCIM inbound provisioning

In the **IdP Connections** window, configure System for Cross-domain Identity Management (SCIM) *(tooltip: \<div class="paragraph">
\<p>An application-level, HTTP-based protocol for provisioning and managing user identity information. SCIM supplies a common schema for representing users and groups and provides a REST API.\</p>
\</div>)* inbound provisioning to provide a two-way mapping of attributes.

## About this task

The first way facilitates SCIM operations used to create and update records in the datastore.

The second way allows the same SCIM client to retrieve those records and have the attribute values mapped back to their corresponding designation in the client store.

The dual mapping provides greater flexibility, especially for OGNL-expression transformations (for example, converting two attributes into one multivalued attribute and then back again).

Learn more in [Writing user information to the datastore](help_inboundprovisioningtasklet_inboundprovisioningoperationwriteusersstate.html) and [Configuring a SCIM response](help_inboundprovisioningtasklet_inboundprovisioningoperationreadusersstate.html).

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | SCIM-client requests must include authentication credentials, which you configure on the **Credentials > Back-Channel Authentication** tab. The same credentials needed for single sign-on (SSO) *(tooltip: \<div class="paragraph">&#xA;\<p>The process of authenticating an identity (signing on) at one website (usually with a user ID and password) and then accessing resources secured by other domains without reauthenticating.\</p>&#xA;\</div>)*, are also used for SCIM transactions. |

## Steps

1. On the **Authentication > Integration > IdP Connections** window, create a new IdP connection or select an existing IdP connection.

2. On the **Connection Type** tab, select the **Inbound Provisioning** checkbox and one of the following options:

   ### Choose from:

   * **User Support**

   * **User and Group Support**

3. On the **Inbound Provisioning** tab, click **Configure Inbound Provisioning** to begin the configuration of SCIM inbound provisioning.

   ![Screen capture of the Inbound Provisioning tab.](_images/djr1564003524330.jpg)